Enable visibility filter on Epics menu pill count

:skip_visibility_check, when true, will not account for the user's
access level when attempting to calculate a number for display in the
sidebar (the "pill count"). This number is strong_memoize'd and cached,
so this change should have negligible performance impact.

Changelog: security
EE: true

ee/app/services/groups/epics_count_service.rb

@@ -11,7 +11,7 @@ module Groups
     def relation_for_count
       EpicsFinder
         .new(user, group_id: group.id, state: 'opened')
-        .execute(skip_visibility_check: true)
+        .execute(skip_visibility_check: false)
     end
 
     def issuable_key

ee/spec/services/groups/epics_count_service_spec.rb

@@ -10,17 +10,33 @@ RSpec.describe Groups::EpicsCountService, :use_clean_rails_memory_store_caching
   subject { described_class.new(group, user) }
 
   describe '#relation_for_count' do
-    before do
-      group.add_reporter(user)
-      allow(EpicsFinder).to receive(:new).and_call_original
+    context "when the user is a reporter" do
+      before do
+        group.add_reporter(user)
+        allow(EpicsFinder).to receive(:new).and_call_original
+      end
+
+      it 'uses the EpicsFinder to scope epics' do
+        expect(EpicsFinder)
+          .to receive(:new)
+          .with(user, group_id: group.id, state: 'opened')
+
+        subject.count
+      end
     end
 
-    it 'uses the EpicsFinder to scope epics' do
-      expect(EpicsFinder)
-        .to receive(:new)
-        .with(user, group_id: group.id, state: 'opened')
+    context "when there are confidential epics" do
+      let_it_be(:epic) { create(:epic, :confidential, group: group) }
+
+      context "when the user has view access to the group and its epics" do
+        it "filters the count by visibility" do
+          allow(Ability).to receive(:allowed?).and_call_original
+          allow(Ability).to receive(:allowed?).with(user, :read_epic, group).and_return(true)
 
-      subject.count
+          expect(group.epics.count).to eq(2)
+          expect(subject.count).to eq(1)
+        end
+      end
     end
   end